@neoline/hostbridge 2.0.3 → 2.0.5

package/src/server_control_mcp/config.py

@@ -10,11 +10,21 @@ from dataclasses import dataclass
 from pathlib import Path
 
 from .secrets import SCHEME, encrypt_secret
+from .secure_files import read_private_text
 
 SCHEMA_VERSION = 1
 _HOST_ID = re.compile(r"^[A-Za-z0-9_.-]+$")
 _CONNECTION_STYLES = {"script", "ssh", "command"}
 _TRANSPORTS = {"auto", "pty", "ssh"}
+_LIMITS = {
+    "max_sessions",
+    "command_timeout_seconds",
+    "max_output_bytes",
+    "max_stdin_bytes",
+    "max_transfer_bytes",
+    "max_text_bytes",
+    "max_shell_bytes",
+}
 
 
 @dataclass(frozen=True, slots=True)
@@ -25,14 +35,15 @@ class ConfigDocument:
     @property
     def hosts(self) -> list[dict[str, object]]:
         value = self.data["hosts"]
-        assert isinstance(value, list)
+        if not isinstance(value, list):
+            raise ValueError("config hosts must be a list")
         return value
 
 
 def load_v1_config(path: Path | str) -> ConfigDocument:
     config_path = Path(path).expanduser()
     try:
-        payload = json.loads(config_path.read_text(encoding="utf-8"))
+        payload = json.loads(read_private_text(config_path))
     except json.JSONDecodeError as exc:
         raise ValueError(f"{config_path} is not valid JSON") from exc
     validated = validate_v1_config(payload, source=config_path)
@@ -108,8 +119,10 @@ def _validate_limits(value: object, source: Path | str, index: int) -> None:
     if not isinstance(value, dict):
         raise ValueError(f"{source}.hosts[{index}].limits must be an object")
     for name, limit in value.items():
-        if not isinstance(name, str) or not isinstance(limit, int) or isinstance(limit, bool) or limit <= 0:
-            raise ValueError(f"{source}.hosts[{index}].limits values must be positive integers")
+        if name not in _LIMITS:
+            raise ValueError(f"{source}.hosts[{index}].limits contains unknown limit {name!r}")
+        if not isinstance(limit, int) or isinstance(limit, bool) or limit <= 0:
+            raise ValueError(f"{source}.hosts[{index}].limits.{name} must be a positive integer")
 
 
 def migrate_config(source: Path | str, destination: Path | str) -> ConfigDocument:
@@ -132,8 +145,7 @@ def migrate_config(source: Path | str, destination: Path | str) -> ConfigDocumen
         secrets = host.get("secrets")
         if isinstance(secrets, dict):
             host["secrets"] = {
-                name: encrypt_secret(secret) if isinstance(secret, str) else secret
-                for name, secret in secrets.items()
+                name: encrypt_secret(secret) if isinstance(secret, str) else secret for name, secret in secrets.items()
             }
         migrated_hosts.append(host)
     payload = validate_v1_config(